CVE-2006-6697: oracle application_server_portal

EPSS trend

Probability

13.10%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.10% on 20-09-2026

20-09-202620-10-2026

EPSS score

13.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasejspVerified
Oracle Portal 9.0.2 - Calendar.jsp Multiple HTTP Response Splitting Vulnerabilities
Maturity: poc

References

9 links

securityreason.com/securityalert/2057Third Party AdvisoryX Refsource SREASON
www.securityfocus.com/archive/1/454965/100/0/threadedMailing ListX Refsource BUGTRAQ
marc.info?l=full-disclosure&m=116664018702238&w=2Mailing ListX Refsource FULLDISC
marc.info?l=full-disclosure&m=116666155824901&w=2Mailing ListX Refsource FULLDISC
secunia.com/advisories/23461Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/455106/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2006/5124VDB EntryX Refsource VUPEN
www.securityfocus.com/bid/21686VDB EntryX Refsource BID
www.securityfocus.com/archive/1/454945/100/0/threadedMailing ListX Refsource BUGTRAQ

Related vulnerabilities

CVE-2003-1193oracleapplication_server_portal+11.76%21y ago10-05-2005 04:00Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL.CVE-2008-2138oracleapplication_server_portal15.51%18y ago12-05-2008 16:00Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing "%0A" (encoded line feed), then using the session ID that is generated from that request. NOTE: as of 20080512, Oracle has not commented on the accuracy of this report.CVE-2004-1707oracleapplication_server+42.57%21y ago26-02-2005 05:00The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0.CVE-2006-6699oracleapplication_server_portal1.33%19y ago23-12-2006 01:00Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter to (1) calendarDialog.jsp or (2) fred.jsp. NOTE: the calendar.jsp vector is covered by CVE-2006-6697.

All vulnerabilities inapplication_server_portal

CVE-2006-6697: oracle application_server_portal

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References